{"action":"Upgrade langchain-experimental to 0.0.21 or later.","affected":[{"fixed":"0.0.21","introduced":"0"}],"component":"langchain-experimental","cve_ids":["CVE-2024-21513"],"ecosystem":"PyPI","epss":0.01893,"exploited":false,"fixed_versions":["0.0.21"],"ghsa_id":"GHSA-cgcg-p68q-3w7v","id":"tcs_01M5KGNBDZ741M7T7SMBTA9BP5","modified_at":"2026-06-10T17:01:09.250129797Z","published_at":"2024-07-15T05:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-62","https://security.snyk.io/vuln/SNYK-PYTHON-LANGCHAINEXPERIMENTAL-7278171","https://github.com/langchain-ai/langchain/blob/672907bbbb7c38bf19787b78e4ffd7c8a9026fe4/libs/experimental/langchain_experimental/sql/vector_sql.py%23L81","https://github.com/langchain-ai/langchain/commit/7b13292e3544b2f5f2bfb8a27a062ea2b0c34561","https://github.com/advisories/GHSA-cgcg-p68q-3w7v"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2024-62","url":"https://osv.dev/vulnerability/PYSEC-2024-62"}],"summary":"Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the database, the code will attempt to call 'eval' o"}